The Information Commissioner’s Office (ICO) has reprimanded a Hampshire law firm after a cyber-attack which resulted in hackers accessing sensitive client details.
The data watchdog discovered that the firm fell short of its obligation to implement robust security measures. As a result, hackers were able to access the firm’s secure cloud-based server. It is believed the stolen data was then published on the dark web.
Subsequently, the investigation discovered that the firm did not have multi-factor authentication (MFA) for the affected domain account and relied on other forms of security measures consisting of computer prompts or strong passwords.
However, hackers were still able to gain access to an administrator-level account through compromised user details. The firm was unable to account for compromised security data.
The ICO said MFA is a ‘basic measure’ that firms processing personal data would be expected to implement.
In response to the incident, the firm has said it has taken remedial action, including introducing MFA for all user accounts, updating service contracts with third-party providers, and a complete review of existing systems.
Source:
Firm sanctioned by ICO after hackers steal clients’ personal details
Regulatory Compliance & Security Risks
Despite the numerous warnings issued by the ICO and the Solicitors Regulation Authority on the increasing cyberattacks aimed at the legal industry, many firms still don’t have the necessary procedures in place. As a result, they are left susceptible to devastating cyber-attacks and further authoritative scrutiny.
All firms are urged to re-evaluate their existing systems, policies, and training programmes to ensure they are compliant with the SRA’s recommendations. The SRA also recommends adopting multi-factor authentication, installing up-to-date antivirus software, and conducting regular security audits to identify and address any weaknesses.
GDPR & Data Protection Services
All firms must ensure they evaluate risk, remain compliant and make every effort to keep staff aware of potential cyber-security dangers. This is achieved through means of robust strategies your firm can put in place to improve its cyber defence.
Our GDPR audit will provide the firm’s management with the confidence of knowing that it is compliant with the cybersecurity requirements and can provide evidence of it. We will identify any issues or concerns along with knowledge gaps and provide solutions to rectify them.
Reach Out to RACO
For more information on the Regulation & Compliance Office and how we can assist in accelerating your risk management, compliance and regulation, call us on
0203 985 8550 or email us at info@regulationandcomplianceoffice.co.uk
